+ -E auto|littleendian|bigendian
+ -T auto|i386|x86-64|*address*|*address,min,max*
+ -W auto|32|64
+ These options force the endianness, text address, and word size for
+ the subsequent domains listed on the command line (or if no domains
+ are listed, then for all domains).
+
+ These default to *auto* which tries to do automatic detection (using
+ libvirt, or details from the memory images themselves). You only
+ need to use these options if virt-mem tools get the automatic
+ detection wrong.
+
+ Endianness (*-E*) sets the memory endianness, for data, pointers and
+ so on. *-E littleendian* is the endianness used on Intel i386,
+ x86-64 and (usually) IA64. *-E bigendian* is the endianness used on
+ many RISC chips such as SPARC and PowerPC.
+
+ Text address (*-T*) sets the base address and optionally min and max
+ addresses of the kernel image. *-T i386* means to try some common
+ addresses for i386-based kernels. *-T x86-64* means to try some
+ common addresses for x86-64-based kernels.
+
+ *-T address* sets the kernel base address specifically (*0x* prefix
+ is used to specify hex addresses). *-T address,min,max* sets the
+ kernel base address, minimum address and maximum address.
+
+ Word size (*-W*) sets the word size, 32 or 64 bits.
+
+ -A auto|i386|x86-64|...
+ This option sets the architecture to one of a collection of known
+ architectures. It is equivalent to setting endianness and wordsize
+ in one go, but not text address.
+
+virt-dmesg
+ This prints the latest kernel messages from the virtual machine, as if
+ you were logged into the machine and used dmesg(1).
+
+virt-uname
+ This prints the contents of the system "utsname" structure, similar to
+ what is printed by the uname(1) command.
+
+virt-mem
+ "virt-mem" is a meta-tool which allows you to run all the commands
+ above, and provides some extra features.
+
+ Instead of the preceeding commands such as "virt-dmesg" you can write:
+
+ virt-mem dmesg [...]
+
+ Options and other command line arguments work the same.
+
+ Additional "virt-mem" subcommands are listed below.
+
+ virt-mem capture -o memoryimage [-options] [domains...]
+ Capture the memory image of a virtual machine for later post-mortem
+ analysis. Use the *-t memoryimage* option for any other virt-mem tool to
+ analyze the memory image later.
+
+ The *-o memoryimage* option is required, and is used to name the output
+ file. If a single guest is captured, then the output is saved in the
+ *memoryimage* file. However, if multiple guests are captured, then their
+ images are saved in *memoryimage.ID* where *ID* is replaced with the
+ domain ID.
+
+ See also the section "MEMORY IMAGES" below.
+
+EXAMPLES
+ # virt-uname
+ f9x32kvm: Linux localhost.localdomain 2.6.24-0.155.rc7.git6.fc9 #1
+ SMP Tue Jan 15 17:52:31 EST 2008 i686 (none)
+
+ # virt-dmesg f9x32kvm | tail
+ <6>Bluetooth: Core ver 2.11
+ <6>NET: Registered protocol family 31
+ <6>Bluetooth: HCI device and connection manager initialized
+ <6>Bluetooth: HCI socket layer initialized
+ <6>Bluetooth: L2CAP ver 2.9
+ <6>Bluetooth: L2CAP socket layer initialized
+ <6>Bluetooth: RFCOMM socket layer initialized
+ <6>Bluetooth: RFCOMM TTY layer initialized
+ <6>Bluetooth: RFCOMM ver 1.8
+ <7>eth0: no IPv6 routers present
+
+MEMORY IMAGES
+ All the tools can read dumped kernel images, using the common *-t
+ memoryimage* option. In addition you can capture memory images from
+ domains for post-mortem analysis using the "virt-mem capture" command
+ (see above).
+
+ The memory images which are saved by "virt-mem capture" contain a header
+ and some additional information about the kernel image, such as
+ architecture, original text address, and so forth. Thus these images can
+ be reanalysed just using the *-t memoryimage* option.
+
+ We also support analyzing raw kernel dumps, eg. produced using the
+ qemu(1) monitor's "memsave" command. In this case however you usually
+ need to specify the original architecture, text address and perhaps
+ other details using the *-A*, *-T* and other command line parameters.